@friggframework/core 2.0.0--canary.690.08cd07e.0 → 2.0.0--canary.694.f66a64a.0

package/integrations/use-cases/run-trigger-tick.js

@@ -0,0 +1,132 @@
+/**
+ * The trigger tick (ADR-055 "Runtime / Tick"): one invocation of an integration's `{integration}Triggers` function.
+ *
+ * It is invoked by one of the integration's schedules: `{ tick: '5m', time }` for the shared tick of its `every` and
+ * `cron` triggers, or `{ at: '<trigger name>', time }` for an `at` trigger. `time` is the schedule's own firing time,
+ * so the slot it falls in, and therefore every due decision and every `scheduledFor`, is the same if the same tick
+ * is delivered twice or carried on by a continuation.
+ *
+ * 1. Page through the ENABLED installations of this integration, `pageSize` (500) at a time, by id.
+ * 2. For each installation and trigger, resolve config, `when` and the cadence (integrations/triggers.js).
+ * 3. Due: `every` when `slot mod n == hash(integrationId) mod n`; `cron` when it fired in (previous tick, this tick];
+ *    `at` always (it is its own schedule).
+ * 4. Send `{ event: 'FRIGG_TRIGGER_RUN', data: { integrationId, trigger, scheduledFor } }` to the integration queue in
+ *    batches, with `DelaySeconds` jitter (a stable 0..min(tick, 900 s) per installation and trigger) for tick runs.
+ * 5. Near the Lambda deadline, send `{ event: 'FRIGG_TRIGGER_TICK', data: { tick|at, time, cursor } }` to the same
+ *    queue and stop; the queue worker carries on from the cursor (IntegrationBase.onTriggerTick).
+ *
+ * Missed ticks are not replayed: a trigger is a "check now" signal, and handlers keep their own watermark.
+ */
+const { parseEvery, lastFiringIn } = require('../../infrastructure/scheduler/recurrence');
+const { TRIGGER_RUN, TRIGGER_TICK, resolveTrigger, dueRun, slotStart, hashId } = require('../triggers');
+
+const PAGE_SIZE = 500;
+const DEADLINE_MARGIN_MS = 30000;
+const MAX_DELAY_SECONDS = 900;   // SQS DelaySeconds ceiling
+
+class RunTriggerTick {
+    /**
+     * @param {Object} deps
+     * @param {Function} deps.integrationClass - the IntegrationBase subclass (Definition.name, triggersFor)
+     * @param {Object} deps.integrationRepository - findIntegrations({ type, status, limit, after })
+     * @param {Object} deps.queue - { batchSend(entries, queueUrl, { delaySeconds }), send(message, queueUrl) }
+     * @param {string} deps.queueUrl
+     * @param {Object} [deps.logger]
+     * @param {number} [deps.pageSize]
+     */
+    constructor({ integrationClass, integrationRepository, queue, queueUrl, logger, pageSize = PAGE_SIZE }) {
+        this.Integration = integrationClass;
+        this.repository = integrationRepository;
+        this.queue = queue;
+        this.queueUrl = queueUrl;
+        this.logger = logger;
+        this.pageSize = pageSize;
+    }
+
+    /**
+     * @param {Object} params
+     * @param {string} [params.tick] - '5m': evaluate the every/cron triggers on this tick
+     * @param {string} [params.at] - an `at` trigger's name: run it for every ENABLED installation
+     * @param {string} [params.time] - the schedule's firing time (ISO); defaults to now
+     * @param {string|number} [params.cursor] - continue after this installation id
+     * @param {() => number} [params.remainingMs] - time left in this invocation
+     * @returns {Promise<{ installations: number, sent: number, pages: number, continued: boolean, failed: Array }>}
+     */
+    async execute({ tick, at, time, cursor, remainingMs = () => Infinity }) {
+        const name = this.Integration.Definition?.name;
+        if (!this.queueUrl) throw new Error(`No queue URL for integration "${name}"; trigger runs have nowhere to go`);
+        const tickMinutes = at ? null : parseEvery(tick);
+        if (!at && tickMinutes === null) throw new Error(`Trigger tick "${tick}" is not a duration`);
+        const timeMs = time && !Number.isNaN(Date.parse(time)) ? Date.parse(time) : Date.now();
+        const slotMs = at ? Math.floor(timeMs / 60000) * 60000 : slotStart(timeMs, tickMinutes);
+        const firings = new Map();   // one cron answer per recurrence per tick (the window is the same), not per installation
+        const firing = (recurrence, from, to) => {
+            const key = `${recurrence.cron}|${recurrence.timezone || 'UTC'}`;
+            if (!firings.has(key)) firings.set(key, lastFiringIn(recurrence, from, to));
+            return firings.get(key);
+        };
+        const delayOf = (m) => (at ? 0 : hashId(`${m.data.integrationId}:${m.data.trigger}`) % Math.min(tickMinutes * 60, MAX_DELAY_SECONDS));
+
+        const out = { installations: 0, sent: 0, pages: 0, continued: false, failed: [] };
+        let after = cursor;
+        for (;;) {
+            const rows = await this.repository.findIntegrations({ type: name, status: 'ENABLED', limit: this.pageSize, after });
+            out.pages += 1;
+            const messages = [];
+            for (const row of rows) {
+                out.installations += 1;
+                try {
+                    const declarations = await this.Integration.triggersFor({ config: row.config || {}, record: row });
+                    for (const declaration of declarations) {
+                        const isAt = declaration.at !== undefined;
+                        if (at ? declaration.name !== at || !isAt : isAt) continue;
+                        const resolved = resolveTrigger(declaration.name, declaration, row.config || {});
+                        if (!at && resolved.tickMinutes !== tickMinutes) continue;
+                        const due = dueRun(resolved, { integrationId: row.id, slotMs, firing });
+                        if (due) messages.push({ event: TRIGGER_RUN, data: { integrationId: row.id, trigger: declaration.name, scheduledFor: due.scheduledFor } });
+                    }
+                } catch (error) {
+                    // One installation's bad config must not stop the others' runs.
+                    out.failed.push({ integrationId: row.id, error: error.message });
+                    this.logger?.warn('Trigger tick skipped an installation', { eventName: 'frigg.triggers.installation_failed', integration: name, integrationId: row.id, error });
+                }
+            }
+            if (messages.length) {
+                await this.queue.batchSend(messages, this.queueUrl, { delaySeconds: delayOf });
+                out.sent += messages.length;
+            }
+            if (rows.length < this.pageSize) return out;
+            after = rows[rows.length - 1].id;
+            if (remainingMs() < DEADLINE_MARGIN_MS) {
+                await this.queue.send({ event: TRIGGER_TICK, data: { ...(at ? { at } : { tick }), time: new Date(timeMs).toISOString(), cursor: after } }, this.queueUrl);
+                out.continued = true;
+                return out;
+            }
+        }
+    }
+}
+
+/** The queue URL Frigg's infrastructure gives an integration: `<NAME>_QUEUE_URL`, dashes as underscores. */
+function queueUrlFor(integrationName) {
+    return process.env[`${String(integrationName).toUpperCase().replace(/-/g, '_')}_QUEUE_URL`];
+}
+
+/**
+ * Run a tick with Frigg's real adapters: the integration repository, the SQS queuer and the integration's queue.
+ * Used by the `{integration}Triggers` Lambda and by a continuation on the queue worker.
+ */
+async function runTriggerTick(integrationClass, event = {}, context) {
+    const { createIntegrationRepository } = require('../repositories/integration-repository-factory');
+    const { QueuerUtil } = require('../../queues');
+    const { getLogger } = require('../../logs');
+    const remainingMs = typeof context?.getRemainingTimeInMillis === 'function' ? () => context.getRemainingTimeInMillis() : undefined;
+    return new RunTriggerTick({
+        integrationClass,
+        integrationRepository: createIntegrationRepository(),
+        queue: QueuerUtil,
+        queueUrl: queueUrlFor(integrationClass.Definition.name),
+        logger: getLogger('frigg.triggers'),
+    }).execute({ tick: event.tick, at: event.at, time: event.time, cursor: event.cursor, remainingMs });
+}
+
+module.exports = { RunTriggerTick, runTriggerTick, queueUrlFor, PAGE_SIZE };

package/integrations/use-cases/run-trigger.js

@@ -0,0 +1,77 @@
+/**
+ * Run one recurring trigger for one installation (ADR-055 "Run"). The queue worker has already hydrated the
+ * installation by `integrationId`; this decides whether the run happens and records it.
+ *
+ * 1. The installation must be ENABLED; anything else discards the run.
+ * 2. With `overlap: 'skip'` (the default) a Process record per (installation, trigger), type `TRIGGER:<name>`, is
+ *    the lease: a run whose record is not terminal and was touched within 2 x tick is still going, so this run is
+ *    skipped and acked. Otherwise the record is reused (one row per installation and trigger, not one per run), set
+ *    RUNNING, and set COMPLETED or ERROR when the handler ends. A failed run is marked ERROR before the error is
+ *    rethrown, so the worker's retry is not skipped by the run it is retrying. `overlap: 'allow'` keeps no record.
+ * 3. Errors go back to the queue worker: its retry, halt and DLQ rules apply as for any queued event.
+ */
+const TERMINAL = ['COMPLETED', 'ERROR'];
+const AT_LEASE_MINUTES = 60;   // an `at` trigger has no tick; its lease is two hours
+
+class RunTrigger {
+    /**
+     * @param {Object} deps
+     * @param {Object} deps.processRepository - findByIntegrationAndType, create, update
+     * @param {() => number} [deps.now]
+     */
+    constructor({ processRepository, now = () => Date.now() }) {
+        this.processRepository = processRepository;
+        this.now = now;
+    }
+
+    /**
+     * @param {Object} params
+     * @param {Object} params.integration - hydrated instance: id, userId, status, telemetry
+     * @param {Object} params.resolved - resolveTrigger(...) for this installation
+     * @param {(payload) => Promise<any>} params.invoke - calls the trigger's handler
+     * @param {{ trigger: string, scheduledFor: string }} params.payload
+     * @returns {Promise<{ status: 'ran'|'skipped'|'discarded', reason?: string, result?: any }>}
+     */
+    async execute({ integration, resolved, invoke, payload }) {
+        const count = (name) => { try { integration.telemetry?.count(name, 1, { trigger: payload.trigger }); } catch (_) { /* never fails a run */ } };
+        if (integration.status !== 'ENABLED') return { status: 'discarded', reason: `installation is ${integration.status}` };
+        if (!resolved?.active) return { status: 'discarded', reason: resolved ? `trigger is ${resolved.inactive}` : 'trigger is not declared' };
+
+        if (resolved.overlap === 'allow') return this.run({ invoke, payload, count });
+
+        const type = `TRIGGER:${payload.trigger}`;
+        const [existing] = await this.processRepository.findByIntegrationAndType(integration.id, type);
+        const leaseMs = 2 * (resolved.tickMinutes || AT_LEASE_MINUTES) * 60000;
+        const touched = existing ? new Date(existing.updatedAt || existing.createdAt || 0).getTime() : 0;
+        if (existing && !TERMINAL.includes(existing.state) && this.now() - touched < leaseMs) {
+            count('trigger.skipped');
+            return { status: 'skipped', reason: `a run of ${payload.trigger} is still going` };
+        }
+
+        const context = { scheduledFor: payload.scheduledFor, startedAt: new Date(this.now()).toISOString() };
+        const record = existing
+            ? await this.processRepository.update(existing.id, { state: 'RUNNING', context })
+            : await this.processRepository.create({ userId: integration.userId, integrationId: integration.id, name: type, type, state: 'RUNNING', context, results: {} });
+        try {
+            const out = await this.run({ invoke, payload, count });
+            await this.processRepository.update(record.id, { state: 'COMPLETED', results: { scheduledFor: payload.scheduledFor, finishedAt: new Date(this.now()).toISOString() } });
+            return out;
+        } catch (error) {
+            await this.processRepository.update(record.id, { state: 'ERROR', results: { scheduledFor: payload.scheduledFor, error: error.message } }).catch(() => {});
+            throw error;
+        }
+    }
+
+    async run({ invoke, payload, count }) {
+        try {
+            const result = await invoke(payload);
+            count('trigger.run');
+            return { status: 'ran', result };
+        } catch (error) {
+            count('trigger.failed');
+            throw error;
+        }
+    }
+}
+
+module.exports = { RunTrigger, TERMINAL };

package/integrations/utils/map-integration-dto.js

@@ -19,48 +19,19 @@ function mapIntegrationClassToIntegrationDTO(integration) {
     };
 }
 
-let deprecationLogged = false;
 
-/**
- * @deprecated Since ADR-059. Read `entityTypeRegistry` / `moduleDefinitions`
- * from `loadAppDefinition()`, or call `getEntityTypeRegistry(appDefinition)`
- * and read each entry's `definition`.
- *
- * Kept as a wrapper over the entity type registry so callers that imported it
- * keep working. It returns the registry's definitions, so it follows the
- * registry's rules: one definition per entity type name (the first wins when
- * two integrations bind different definitions under one name, as
- * ModuleFactory already picked), and, when `entities` is passed, registry-only
- * types are included and conflicts throw `EntityRegistryError`.
- *
- * @param {Array<Function>} integrationClasses - integration classes
- * @param {Object} [entities] - `appDefinition.entities` (ADR-059)
- * @returns {Array<Object>} API module definitions
- */
-function getModulesDefinitionFromIntegrationClasses(
-    integrationClasses,
-    entities
-) {
-    // Required here, not at the top: modules/ must not load at require time
-    // of every integration use case that only wants the DTO mapper.
-    const {
-        getEntityTypeRegistry,
-        getEntityTypeDefinitions,
-    } = require('../../modules/entity-type-registry');
-    if (!deprecationLogged) {
-        deprecationLogged = true;
-        const { getLogger } = require('../../logs');
-        getLogger('frigg.integrations').warn(
-            'getModulesDefinitionFromIntegrationClasses is deprecated; use getEntityTypeRegistry (ADR-059)',
-            { eventName: 'frigg.integrations.deprecated_module_definitions' }
-        );
-    }
-    return getEntityTypeDefinitions(
-        getEntityTypeRegistry({ integrations: integrationClasses, entities })
-    );
-}
-
-module.exports = {
-    mapIntegrationClassToIntegrationDTO,
-    getModulesDefinitionFromIntegrationClasses,
+const getModulesDefinitionFromIntegrationClasses = (integrationClasses) => {
+    return [
+        ...new Set(
+            integrationClasses
+                .map((integration) =>
+                    Object.values(integration.Definition.modules).map(
+                        (module) => module.definition
+                    )
+                )
+                .flat()
+        ),
+    ];
 };
+
+module.exports = { mapIntegrationClassToIntegrationDTO, getModulesDefinitionFromIntegrationClasses }; 

package/modules/index.js

@@ -4,15 +4,6 @@ const { OAuth2Requester } = require('./requester/oauth-2');
 const { Requester } = require('./requester/requester');
 const { ModuleConstants } = require('./ModuleConstants');
 const { ModuleFactory } = require('./module-factory');
-const {
-    getEntityTypeRegistry,
-    EntityRegistryError,
-} = require('./entity-type-registry');
-const {
-    resolveScope,
-    listBindingScopes,
-    OwnershipConfigError,
-} = require('./entity-scope');
 
 module.exports = {
     ApiKeyRequester,
@@ -21,9 +12,4 @@ module.exports = {
     Requester,
     ModuleConstants,
     ModuleFactory,
-    getEntityTypeRegistry,
-    EntityRegistryError,
-    resolveScope,
-    listBindingScopes,
-    OwnershipConfigError,
 };

package/modules/module-factory.js

@@ -45,18 +45,6 @@ class ModuleFactory {
             );
         }
 
-        // definition.env may be an async function (e.g. the db-credentials
-        // extension's bootstrap loads OAuth app credentials from the
-        // database); resolve it first. A static env keeps the plain
-        // constructor, exactly as before.
-        if (typeof moduleDefinition.env === 'function') {
-            return await Module.create({
-                userId,
-                entity,
-                definition: moduleDefinition,
-            });
-        }
-
         return new Module({
             userId,
             entity,

package/modules/module.js

@@ -21,17 +21,8 @@ class Module extends Delegate {
      * @param {string} params.userId The user id
      * @param {Object} params.entity The entity record from the database
      * @param {string} [params.state] Optional OAuth state value forwarded to the API client (round-trips through the OAuth provider).
-     * @param {Object} [params.resolvedEnv] definition.env as Module.create() resolved it (may be undefined).
-     * @param {boolean} [params.envResolved=false] true when resolvedEnv carries the resolved env, even an undefined one; otherwise the static definition.env is used.
      */
-    constructor({
-        definition,
-        userId = null,
-        entity: entityObj = null,
-        state = null,
-        resolvedEnv,
-        envResolved = false,
-    }) {
+    constructor({ definition, userId = null, entity: entityObj = null, state = null }) {
         super({ definition, userId, entity: entityObj });
 
         this.validateDefinition(definition);
@@ -63,23 +54,8 @@ class Module extends Delegate {
 
         Object.assign(this, this.definition.requiredAuthMethods);
 
-        // A pre-resolved env (Module.create()) supports definition.env as an
-        // async function, e.g. OAuth app credentials loaded from the database
-        // by the db-credentials extension; otherwise the static object.
-        // "Resolved" is an explicit flag, not a non-null value: a function env
-        // may legitimately resolve to undefined (no static env, no DB row),
-        // and falling back to definition.env would then read the function.
-        const envValues = envResolved ? resolvedEnv : this.definition.env;
-        if (typeof envValues === 'function') {
-            // Spreading a function yields no keys, so the API client would
-            // silently get no client_id / client_secret.
-            throw new TypeError(
-                `Module ${this.name}: definition.env is a function; build the module with await Module.create(...)`
-            );
-        }
-
         const apiParams = {
-            ...envValues,
+            ...this.definition.env,
             delegate: this,
             logger: this.logger,
             ...(state ? { state } : {}),
@@ -91,33 +67,6 @@ class Module extends Delegate {
         this.api = new this.apiClass(apiParams);
     }
 
-    /**
-     * Resolves definition.env, supporting both a static object and a
-     * (possibly async) function.
-     *
-     * @param {Object} definition - Module definition
-     * @returns {Promise<Object|undefined>} Resolved env values
-     */
-    static async resolveEnv(definition) {
-        if (typeof definition.env === 'function') {
-            return await definition.env();
-        }
-        return definition.env;
-    }
-
-    /**
-     * Async factory that resolves definition.env first, so a module whose
-     * env is a function gets its values. Prefer it over `new Module(...)`
-     * wherever the call site can await.
-     *
-     * @param {Object} params - same as the constructor, minus resolvedEnv
-     * @returns {Promise<Module>}
-     */
-    static async create({ definition, userId = null, entity = null, state = null }) {
-        const resolvedEnv = await Module.resolveEnv(definition);
-        return new Module({ definition, userId, entity, state, resolvedEnv, envResolved: true });
-    }
-
     getName() {
         return this.name;
     }

package/modules/repositories/module-repository-documentdb.js

@@ -3,14 +3,12 @@ const {
     toObjectId,
     fromObjectId,
     findMany,
-    findManyDrained,
     findOne,
     insertOne,
     updateOne,
     deleteOne,
 } = require('../../database/documentdb-utils');
 const { ModuleRepositoryInterface } = require('./module-repository-interface');
-const { entityNotFoundError } = require('./entity-not-found');
 const { DocumentDBEncryptionService } = require('../../database/documentdb-encryption-service');
 
 /**
@@ -35,11 +33,11 @@ class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
     async findEntityById(entityId) {
         const objectId = toObjectId(entityId);
         if (!objectId) {
-            throw entityNotFoundError(entityId);
+            throw new Error(`Entity ${entityId} not found`);
         }
         const doc = await findOne(this.prisma, 'Entity', { _id: objectId });
         if (!doc) {
-            throw entityNotFoundError(entityId);
+            throw new Error(`Entity ${entityId} not found`);
         }
         const credential = await this._fetchCredential(doc.credentialId);
         return this._mapEntity(doc, credential);
@@ -78,29 +76,6 @@ class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
         return docs.map((doc) => this._mapEntity(doc, credentialMap.get(fromObjectId(doc.credentialId)) || null));
     }
 
-    /**
-     * Find entities matching any of the owner/organization pairs, in one query.
-     * `organizationId: null` matches rows with no organization (a raw MongoDB
-     * `null` also matches a missing field). The caller (a use case) decides
-     * which pairs; this only runs them.
-     *
-     * @param {Array<{userId: string, organizationId: (string|null)}>} clauses
-     * @returns {Promise<Array>}
-     */
-    async findEntitiesByOwnership(clauses) {
-        if (!Array.isArray(clauses) || clauses.length === 0) return [];
-        // Drained: a list can hold more than the first cursor batch (~101).
-        const docs = await findManyDrained(this.prisma, 'Entity', {
-            $or: clauses.map(({ userId, organizationId }) => ({
-                userId: toObjectId(userId),
-                organizationId:
-                    organizationId === null ? null : toObjectId(organizationId),
-            })),
-        });
-        const credentialMap = await this._fetchCredentialsBulk(docs.map((doc) => doc.credentialId));
-        return docs.map((doc) => this._mapEntity(doc, credentialMap.get(fromObjectId(doc.credentialId)) || null));
-    }
-
     async unsetCredential(entityId) {
         const objectId = toObjectId(entityId);
         if (!objectId) return false;
@@ -140,14 +115,7 @@ class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
         );
     }
 
-    /**
-     * @param {Object} entityData
-     * @param {{organizationId?: (string|null)}} [tenancy] - the organization the entity
-     *   belongs to (ADR-056 §3.6). A separate argument, not a field of `entityData`,
-     *   because `entityData` carries provider fields and one named `organizationId`
-     *   must not be taken for ours.
-     */
-    async createEntity(entityData, tenancy = {}) {
+    async createEntity(entityData) {
         const {
             user,
             userId,
@@ -165,7 +133,6 @@ class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
             name: name ?? null,
             moduleName: moduleName ?? null,
             externalId: externalId ?? null,
-            organizationId: toObjectId(tenancy.organizationId) || null,
             data: dynamicData,
         };
         const insertedId = await insertOne(this.prisma, 'Entity', document);
@@ -280,9 +247,8 @@ class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
             const objectIds = ids.map(id => toObjectId(id)).filter(Boolean);
             if (objectIds.length === 0) return new Map();
 
-            // Raw read to bypass the Prisma encryption extension. Drained:
-            // more ids than the first cursor batch must all come back.
-            const rawCredentials = await findManyDrained(this.prisma, 'Credential', {
+            // Use raw findMany to bypass Prisma encryption extension
+            const rawCredentials = await findMany(this.prisma, 'Credential', {
                 _id: { $in: objectIds }
             });
 
@@ -363,30 +329,19 @@ class ModuleRepositoryDocumentDB extends ModuleRepositoryInterface {
         if (filter.name) query.name = filter.name;
         if (filter.moduleName) query.moduleName = filter.moduleName;
         if (filter.externalId) query.externalId = filter.externalId;
-        // `null` means "no organization"; absent means "any". A raw MongoDB
-        // `{ field: null }` matches both a null value and a missing field.
-        if (filter.organizationId !== undefined) {
-            query.organizationId =
-                filter.organizationId === null
-                    ? null
-                    : toObjectId(filter.organizationId);
-        }
         return query;
     }
 
     _mapEntity(doc, credential) {
         const dynamicData = doc?.data || {};
         return {
-            // First, so no stored provider field can replace a column below
-            // (identity, owner or organization decide who sees the entity).
-            ...dynamicData,
             id: fromObjectId(doc?._id),
             credential,
             userId: fromObjectId(doc?.userId),
             name: doc?.name ?? null,
             externalId: doc?.externalId ?? null,
             moduleName: doc?.moduleName ?? null,
-            organizationId: fromObjectId(doc?.organizationId) ?? null,
+            ...dynamicData,
         };
     }
 }

package/modules/repositories/module-repository-interface.js

@@ -67,21 +67,6 @@ class ModuleRepositoryInterface {
         );
     }
 
-    /**
-     * Find entities matching any of the owner/organization pairs, in one query
-     * (ADR-056 §3.6). `organizationId: null` matches rows with no organization.
-     * Which pairs is decided by the caller (modules/entity-scope.js), not here.
-     *
-     * @param {Array<{userId: string|number, organizationId: (string|number|null)}>} clauses
-     * @returns {Promise<Array>} Array of entity objects
-     * @abstract
-     */
-    async findEntitiesByOwnership(clauses) {
-        throw new Error(
-            'Method findEntitiesByOwnership must be implemented by subclass'
-        );
-    }
-
     /**
      * Unset credential from entity
      *
@@ -125,13 +110,11 @@ class ModuleRepositoryInterface {
     /**
      * Create a new entity
      *
-     * @param {Object} entityData - Entity data (provider fields included)
-     * @param {{organizationId?: (string|number|null)}} [tenancy] - the organization
-     *   the entity belongs to (ADR-056 §3.6), kept apart from `entityData`
+     * @param {Object} entityData - Entity data
      * @returns {Promise<Object>} Created entity object
      * @abstract
      */
-    async createEntity(entityData, tenancy) {
+    async createEntity(entityData) {
         throw new Error('Method createEntity must be implemented by subclass');
     }